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Abstract 

The fastest quantum algorithms (for the solution of classical computational tasks) known so far are 
basically variations of the hidden subgroup problem with f(U[x]) = f{x). Following a discussion regarding 
which tasks might be solved efficiently by quantum computers, it will be demonstrated by means of a simple 
example, that the detection of more general hidden (two-point) symmetries V{f(x),f(U[x])} — by a 
quantum algorithm can also admit an exponential speed-up. E.g., one member of this class of symmetries 
V{f(x),f(U[x])} = is discrete self-similarity (or discrete scale invariance). 
PACS: 03.67.Lx, 89.70.+C. 



1 Introduction 

Shor's striking discovery £Q, that quantum computers could accomplish tasks such as factoring large numbers 
exponentially faster than the best (known) classical methods, motivates the quest for further quantum 
algorithms exhibiting an exponential speed-up, see, e.g., |5] for a review. Together with a number of black- 
box problems |3] |1J |SJ Ej, some of which also admit an exponential speed-up, Shor's algorithm can be 
generalised to the so-called "hidden subgroup problem" : given a function / with the property 

Vx,y : f{x) = f(y) «-» y G U z x , (1) 

for some transformation U, find U. I.e., / is constant on the co-sets of the subgroup {x, Ux, U 2 x, U 3 x, . . . } 
generated by U and assumes a different value at each co-set. (Here we restrict our consideration to the 
case of one generator U only, for more than one generators, the situation is analogous.) For example, in 
the case of Shor's algorithm, the transformation U is given by U[x] = x + p, and for Simon's problem, 
it is U[x] = x (Bp with © denoting the bit-wise addition modulo two, e.g., 1001 © 0101 = 1100. (Note that 
x ffip ffip = x.) 

Hence, in comparison with classical methods, the number of known quantum algorithms which are (as far 
as we know) significantly faster is tiny - but one might hope that there are many more to be discovered. The 
question we wish to examine is: which other problems - and perhaps further expansions of the known tasks 
- could (also) admit an exponential speed-up? More precisely, we shall investigate whether there are general 
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features of problems which are important for an exponentially fast quantum algorithm, and give a specific 
example (in which such a speed-up is accomplished) via an extension of Simons's and Shor's problem. 

In particular we shall consider problems which can be cast into the following form: given a function 
/ : x — > f(x) on an exponential number of arguments x, where / is known to possess some property 
(from a given class of properties) , find that property - where the term "property" can refer to any extracted 
information in general. Evaluating f(x) on a given arbitrary argument x is assumed to be polynomially (in 
the length of x) implementable . We shall investigate some features of the class of properties with an 
(apparently) exponential speed-up by a quantum computer over a classical one. We shall also show how 
such an exponential speed-up can be achieved for a property we call a hidden symmetry. 

Note that our discussion will not be concerned with the use of quantum computation to simulate physical 
systems, nor with the application of quantum phenomena to transmit information (quantum cryptography 
or super-dense coding, etc.) or to extract information from an external physical system (such as quantum 
imaging, see, e.g., or Elitzur-Vaidman-type problems |5]), i.e., we only consider quantum information 
processing. 

2 Relevance of arguments 

One aspect which seems 7 to be important for an exponential speed-up is the relevance of the arguments 
x with respect to the property under consideration. 

Typically, sequential |10[ quantum algorithms for solving problems as described above can be formulated 
as black-box algorithms which can be cast into the following most general form 

|*) = Um U f Um-l ...Ux Uf Uo |0) , (2) 

where the unitary gate Uf calculates the (black-box) function /, i.e., Uf \x) \y) = \x) \y © f(x)), with the 
possible extension Uf W/ <S> 1 ; and additional unitary operations Uo . . . U m ■ Even if the algorithm originally 
contained an intermediate measurement, it could still be rewritten in this form by using ancilla qubits and 
quantum-controlled operations. 

In order to achieve an exponential speed-up the number m as well as the realisations of the unitary 
operations Uo . . . U m have to be polynomial. Consequently, if the number of arguments x of the function 
f(x) that contain relevant information (for the solution of the problem) is exponentially small, then the part 
of the output state I*) corresponding to this relevant information is apparently also exponentially small, 
and therefore impossible to extract with a polynomial number of measurements. Supportive (though not 
conclusive |7j) to this point is inserting the identity 

Uf = (Vrel + Vi tI )Uf ("P re l + Plrr) , (3) 

into Eq. (|5J, where V r A and V m denote the (orthogonal) projections onto the subspaces of relevant and 
irrelevant arguments x, respectively. Assuming that the unitary operations Uo ■ ■ - Um do not favour the 
subspace spanned by Vrci (we do not know in advance which arguments x are going to be important and 
which not) the norm of (the sum of) all terms containing at least one T-'rei is exponentially small for the 
unitary operations are norm-preserving. 

As a result, a function with an exponentially small number of relevant arguments x does not seem suitable 
for an exponential speed-up. Of course, this feature crucially depends on the particular way of encoding 
the problem to be solved by a function - e.g., a function denned as f(x) = 1 if x is a factor of y and 
f(x) — otherwise would not be the best choice for factoring 111] , One should also bear in mind that the 
above arguments do not exclude polynomial speed-up - the Grover search routine (12) achieves a quadratic 
speed-up by exploiting the bilinear structure of quantum theory, i.e., the normalisation by l/V~N instead of 
1/N. 

The task of period-finding, for example, where all arguments x are equally relevant for the solution, is 
therefore indeed (as it should be) a good candidate for an exponential speed-up by a quantum algorithm. 

tl.e., the problem to be solved must be at least in PSPACE - remember that PC NPC PSPACE, see, e.g., 
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As counter-examples (which are probably not good candidates for an exponential speed-up), we may quote 
the usual form of the travelling salesman problem [with x being one particular route and f(x) the associ- 
ated length] or the task of evaluating the position in chess^ where a posteriori almost all arguments x are 
completely irrelevant - but we do not know a priori which. 

3 Excess information 

Since every quantum computation is (at least in principle) unitary and hence reversible, it is impossible 
to lose any information during this process - except by the (final) measurement (e.g., the phases are lost) 
or by transferring the information from the quantum system (computer) alone to its entanglement with 
the "environment". We want to extract only a certain property of the function / - other details of / are 
irrelevant - and, therefore, we have to find a way to dispose of this excess information. For example, in 
Shor's problem f(x) = f(x + p), we only want to know the period p, and not any other details of /. After 
the measurement of the register |/) one is left with the state 



This state contains very little information - basically just the starting point xq and the period p - which, 
after a quantum Fourier transform, determine the phase and the value of the wave-number, respectively. 

Of course, here we have to explain the phrase "very little information". To this end we introduce the 
notion of the "classical information of a quantum state as the information required to reproduce the 
state ys>) starting from the state |0) in the computational basis via elementary operations |7|. Note that this 
notion is obviously not a unitarily invariant (quantum) information measure (as |^) is still a pure state). 
But since we want to speed up the solution of classical problems, we should consider the involved quantum 
operations from a classical point of view. 

In summary, we arrive at an (admittedly rather vague 0) additional condition - "not too much excess 
information" - for a (classical) problem which is supposed to admit an exponential (quantum) speed-up. 
As a counter-example, we might consider the average invertability check (collision problem) of a function 
f(x) - i.e., for a given (representative) y in the co-domain, how many x satisfy (in average) f(x) = y. (This 
problem is relevant for cryptography.) Although obviously almost all arguments x are equally important, 
the state after the measurement of / apparently still contains too much excess information 1 ' (the different 
and independent coordinates x satisfying f(x) — y) to get rid of |14| . 

4 Hidden symmetries 

As one would reasonably expect, the hidden subgroup problem satisfies the above requirements - all ar- 
guments x are equally relevant and the state after the measurement of / is basically determined by one 
starting point xo and the generator U (e.g., p) of the subgroup. This feature is ensured by the existence 
of the symmetry Q connecting the values of the function / at each two points x and U[x] with a certain 
relation, i.e., f(x) = f(U[x]). In view of the above remarks, one might expect a similar effect for a more 
general hidden two-point symmetry of the form 



§ If x denotes one possible continuation of the game (a so-called "line") and f(x) the outcome (win, loss, or draw) then the 
vast majority of arguments x are irrelevant for accessing the position because almost all lines with random moves are completely 
uninteresting. 

^Note that our notion "classical information of a quantum state \^)" is different from the generalisation of the Kolmogorov 
complexity to the quantum case introduced in 1131 . The latter quantity is bounded from above 1131 and its upper bound of 
approximately 2n (where n is the number of qubits) would just correspond to the information contained in xo and p for Shors 
algorithm. In contrast, the "classical information of a quantum state \^)" introduced here can exceed this bound by far: For the 
collision problem, the different and independent coordinates x satisfying f(x) = y typically contain much more information. Hence 
the generalisation of the Kolmogorov complexity proposed in 1131 cannot be used to discriminate between the two cases (Shors 
algorithm and the collision problem). 




(4) 



V{f(x),f(U[x})}=0, 



(5) 
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where V is some relation generalising the equality in the hidden subgroup problem Q. 

Of course, it remains to be shown whether it is possible to design a quantum algorithm which determines 
U and V exponentially faster than classical methods. One of the major benefits of quantum computation is 
the superposition principle allowing us to test all possible values of x at once ("quantum parallelism"). In 
view of this observation one would expect that it is advantageous to represent the symmetry operations in 
a (somehow 0) linear fashion. (This seems to be much easier for Abelian than for non-Abelian symmetry 
groups.) For this reason, and for the sake of simplicity, we focus on Simon- and Shor-type symmetries in 
the following. 



5 Simon-type symmetry 

As an expansion of Simon's problem with the periodicity condition f(x © p) = f(x) we consider 

V{f(x),f(U[x])} = f(x)®f(x(Bp)®q = - f(x®p)=f(x)®q, (6) 

with x, f(x),p,q £ {0, 1}™, and the task is to find out p and q. For convenience, we shall identify bit-strings 
with integers {0, 1}™ <-> {0, . . . , 2 n — 1} via the usual binary representation in the following. I.e., x, f(x),p, q 
are treated as integers with < x, f(x),p,q < N = 2™. 

In complete analogy to Simon's algorithm we apply the usual trick of inquiring all entries at once 
(quantum parallelism) and obtain the state 

UN _ ( V° Ml/fro)) + \xo(Bp)\f(x )(Bq) 

But instead of measuring the second register |/) we now perform a multiple application of the Hadamard 
gate to both, the first |a;) and the second |/) register 

(JV/2) (N 2 /2) 

W Pn) |v)= 2 ^ £ (-1) XY \Y), (8) 

* {^o> {Y:R-Y=0} 

where we have introduced the abbreviations \X) = \xq) ® \f(xo)) and \R) = \p) ® \q) as well as the scalar 
product modulo two given by 

2n n 

R ■ Y = J2 R i Y ' mod 2 = (viYi © qiY n+l ) . (9) 

1=0 1=0 

Assuming that the values f(xo) are pseudo-randomly distributed, i.e., without any internal order (cf. the 
next Section), the measurement of Y returns arbitrary values satisfying the constraint R • Y = 0. Again in 
complete analogy to Simon's algorithm, after 0(n) runs we have enough measured values of Y for determining 
R, i.e., p and q, with arbitrarily high probability (exponential speed-up). 



6 Requirements 

In which cases can the above quantum algorithm fail, i.e., what exactly does the aforementioned condition 
"without any internal order" imply? 

As a counter-example - where the algorithm must fail - consider the function 

f(x) = A-x®b, (10) 

with a binary iV x A r -matrix A and the bit-wise scalar product modulo two as in Eq. ©. This funct ion 
exhibits a strong internal order and hence a plethora of symmetries: any p and the corresponding q given by 

q = A-p, (11) 

satisfies Eq. @. 
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On the other hand, as an example where the above quantum algorithm works, we might construct the 
function f(x) as follows: After splitting up the set of all arguments {x} = {0 . . . A} into two disjoint sets of 
equal strength A/2 via {xo} and {xo(Bp}, we assign all f(xo) random values between and A and determine 
the remaining ones via f(x © p) = f(x) © q. In this rather artificial way we can make sure that there is no 
additional internal order which could spoil the above algorithm. 

In summary, we do not allow additional (exact or average) symmetries apart from the one in Eq. © 
which lead to another value R' 7^ R with the probability of measuring R' • Y = 1 being strongly suppressed. 

Let us discuss the relation of the hidden symmetry discussed above to the hidden sub-group problem. 
Defining new functions such as j!7j 

hi(x,y) = f{x)®y, h 2 (x,y) = f{x) © f(y) , (12) 

the symmetry f(x © p) — f(x) © q translates into periodicity 

hi(x,y) = h\{x®p,y®q) , h 2 (x,y) = h 2 (x®p,y®p) ■ (13) 

However, this identification does not imply that the property in Eq. © can be mapped onto the hidden sub- 
group problem as in Eq. Q because the functions h\ >2 : {1, . . . , A 2 } — > {1, . . . , A} are highly degenerate 
and hence not distinct on different co-sets. 

The fact that one can nevertheless find p (and q) by a quantum algorithm (which is not necessary for such 
a large degeneracy) is caused by the special underlying symmetry f(x(Bp) = f(x) © q and the assumption 
discussed above (no additional internal order). Therefore, this is a true expansion of the hidden sub-group 
problem |17) with the distinctness on different co-sets being replaced by the pseudo-randomness requirement. 



7 Shor-type symmetry 

As a second example for a hidden (two-point) symmetry, we study the following expansion of Shor's problem 
f(x + p)=f(x) 

f(x + p)=f(x) + q, (14) 

with < x,f(x) < N = 2™. Similar to the original period-finding algorithm, we demand that p is much 
smaller than A, say p = 0(N £ ) with a small but positive number < e < 1, which will be determined 
below. In addition, we assume p>g (but still g> 1) - otherwise we would have to insert a "modulo A", 
i.e., f(x + p) — f(x) + q mod A. 

In this situation, the usual superposition state after the application of the unitary gate calculating the 
function / reads 

1*) ~ E xf l^°JiMM^£j-±ig) (15) 

x =0 1=0 

where [N/p] denotes the integer part of N/p S> 1 and the « sign is caused by the corresponding neglect of 
a small number of arguments x and the fact that not all periods are complete (remember p^> q). 

Again we do not measure the second register at this stage but apply a double quantum Fourier transform, 
i.e., we Fourier transform each register 

^ <2) I*)-E E E" ym J2e,p\2ni P -^±^l\\k x )\k y ). (16) 

k m =0k y =0:co=0 "V !=0 ' 

Although the measurements of k x and k y considered separately typically return almost random numbers - 
provided that there is no structure (e.g., an additional periodicity, cf. the previous example as well as Sec.[HJ 
in the values f(xo) - these numbers k x and k y display an extremely strong correlation: the above /-sum 
exhibits a constructive interference if and only if 

eN±c?m (17) 



A \N 
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holds; and, accordingly, a large fraction of the measured values for k x and k y will obey this relation. 

However (in contrast to Shor's algorithm) one measurement of k x and k y may not suffice for determining 
p and q in general. To this end, it might be necessary to repeat the whole process a few times - resulting in 
pairs of measured values (k x , kt) with a labelling the number of the measurement. One possibility to derive 
p and q is to find a set of A £ poly(n) integers a„6Z with \a a \ < M <C TV which satisfy 

A 

J2 a a ky mod TV = O(M) . (18) 
Inserting the above condition back into Eq. (1171 , we obtain (remember p^> q) 

££«.* g N ±0 (^V (19) 

a — 1 ^ ' 

Having eliminated q in this way, we may find p via the continued fraction expansion [5] of 

provided that the denominator p is small enough, i.e., p <C \/TV /V AM. There are two limits on the size of 
the auxiliary number M: firstly, it should be small enough to allow the detection of sufficiently large values 
of p with p <C vTV /V AM, and, secondly, M must be adequately large such that a small number of measured 
pairs (&", ky) will allow us to satisfy Eq. HSU with the probability that all of these pairs obey the resonance 
condition 1171 not being exponentially suppressed. 

For example, choosing M = vTV, we may find A = 2 numbers \ai\ < y/N and |o:2 1 < V~N via the 
continued fraction expansion of the ratio k\jk\ truncated at order \f~N which then satisfy 02/01 + k y /ky = 
0(1/ N) and thus a\k y +ct2ky = 0(y/N). This allows us to find periods p satisfying p <C \YN in two runs of 
the quantum algorithm with high probability. Note the difference of the above method to Shor's algorithm 
which requires p <C vTV instead. 

More generally, if p — 0(N E ) is small enough (e.g., e < 1/4, see the above example), we are able to 
determine p (i.e., U) and thereby also q (i.e., V) in polynomial time (exponential speed-up). 



8 Discrete self-similarity 

Let us give an example where the above algorithm could be useful. Starting from the Shor-type symmetry 
f(x + p) = f(x) + q in Eq. 11411 and setting 

/ = log(0) , x = log( X ) , (21) 

with respect to some base(s), we arrive at 

<Hax)=/?<Kx), (22) 

i.e., the function (p(x) is discretely self-similar. Discrete self-similarity - also called discrete scale invari- 
ance - is a characteristic feature of some non-linear systems (e.g., in condensed matter) exhibiting critical 
phenomena, see, e.g., |18) . 

For example, let us assume that the unitary gate U$ represents some characteristic parameter in the 
quantum simulation of a condensed matter system in the critical regime and that this parameter <j> displays 
a discretely self-similar but otherwise chaotic dependence on some input \. For the sake of simplicity, let us 
further assume that we can calculate the logarithms of the output <f> and the input \ with respect to suitable 
bases within an appropriate discretisation (either artificial or natural, e.g., physical lattice). In this way the 
accomplished generalisation of pure periodicity f(x + p) = f(x) <-> cj>(ax) = 4>{x) to discrete self-similarity 
in Eq. 122H in the presented quantum algorithm allows us to detect the discretely self-similar behaviour 
exponentially faster than any (known) classical method. 
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9 Summary 



By means of a simple example, it has been demonstrated that the task of finding hidden (two-point) symme- 
tries of a given function described by Eq. - as an expansion of the hidden subgroup problem in Eq. Q 
- can also be accomplished exponentially faster by a (probabilistic) quantum algorithm than by classical 
methods. 

There are two main possibilities for generating ./VP-problems (i.e., the solution is potentially hard to find 
but easy to verify, at least probabilistically) in this way - either both, U <-> p and V <-> q, are unknown or 
V <-> q is given and we have to find "only" U <-> p (Of course, if p was known, the problem would be 

trivial.) 

Note that the task under consideration is very similar to an inverse problem where the input(s) and the 
output (s) of a function depending on a parameter are given and one has to find the fitting parameter. We 
consider the main importance of our result in its being a small step towards the goal of better understanding 
the class of problems which can be solved exponentially faster by quantum algorithms. 



10 Outlook 

Eq. © does not represent the most general (explicit) two-point symmetry, which can be written as 

V{x,f(x),f(U[x,f(x)])} = 0. (23) 

In this case there is no /-independent co-set in general and it would be interesting to study the possibilities 
of speeding up these more complicated (consistency, etc.) problems by quantum algorithms. As another 
extension of Eq. JQ, it appears quite natural to ask about relations involving more, say (m + 1), points 

V {f(x),f(U! [x]),..., f{U m [x])} = . (24) 

Further interesting symmetries" could include other transformations U and relations V - think of gauge 
symmetries, for example, or permutations (and other possibly non-Abelian groups). 

Another point is that, in the examples considered above (and in the hidden subgroup problem, of course), 
V was invertible, i.e., one could solve the relation Eq. for f(x). Relaxing this invertability condition 
would be another interesting object of study. As a very simple example, one might consider the following 
symmetry 

n 

0MaO©/»(*©P) = °. (25) 
where one can determine p (again assuming appropriate conditions) via defining a new function F(x) = 

n 

®fi(x). 

1=0 
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f(x + p) = f(x) © q, the first case is inconsistent in general since another iteration leads to a contradiction fix) = f(x) + 2q\ and 
the second example can be reduced to Shor's case f(x + 2p) = fix). 
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